The program can also be run normally (not through the command-line). You can speed up the extraction and report generation by redirecting the command-line output to the NUL device.Įxample: thumbcache_viewer_cmd.exe thumbcache_32.db > NUL If you wish to save the command-line output to a file, you can use the redirect operator.Įxample: thumbcache_viewer_cmd.exe thumbcache_32.db > output.txt
If you don't have a mouse wheel, you can hold the right mouse button down and click the left mouse button to zoom in, or hold the left mouse button down and click the right mouse button to zoom out. If you have a mouse wheel, you can scroll forward to zoom in, or scroll back to zoom out. To scale the image you can press the + or - keys to zoom in or out respectively. To center the image in the image window you can either press the Home key, or middle mouse button. By holding Shift and pressing an arrow key, the image will move 25 pixels. By holding Ctrl and pressing an arrow key, the image will move 5 pixels. Each arrow key will move the image 1 pixel in that direction. You can move the image around the window with the mouse or arrow keys. When an item is selected, an image window will pop up to preview the thumbnail. The three hash columns (Data Checksum, Header Checksum, and Cache Entry Hash) will change from lowercase, to uppercase. Likewise, the Cache Entry Offset column will change from bytes, to kilobytes. If you press Ctrl and click the Data Size column, for example, the entries will change from displaying in kilobytes, to simply bytes. Some of the column headers for the list can be clicked (while pressing Ctrl) and the entries below them will change. An edit box will display to rename the file. To rename a file in the list, click once on a selected list item. Mapped entries that included extended information while searching the Windows.edb will be displayed in green. Mapping files using Windows.edb (ESE database) should be done on an operating system that shares the same or newer operating system version in which the Windows.edb was generated. This ensures that the correct inputs can be hashed to compare against the entry hash in the database. Another thing to note is that mapping files by scanning directories must be done on the same computer system in which the database was generated. It's not that common to see unless the database has been overwritten or truncated. When verifying entries, mismatched checksums will be displayed in red along with the correct value. The main menu will allow you to save entries, export entries to a CSV (comma-separated values) file, remove entries from the list (the database is not modified), hide 0 byte entries, verify CRC-64 header and data checksums, and map files to entry hashes. Looking to open Thumbs.db files? Try my Thumbs Viewer instead. The program comes in two flavors: a graphical user interface and command-line interface.
Thumbsplus 10 mouse hover thumbnail turn off windows#
Thumbcache Viewer allows you to extract thumbnail images from the thumbcache_*.db and iconcache_*.db database files found on Windows Vista, Windows 7, Windows 8, Windows 8.1, and Windows 10. Thumbcache Viewer - Extract thumbnail images from the thumbcache_*.db and iconcache_*.db database files.